Role in IT decision-making process:Align Business & IT GoalsCreate IT StrategyDetermine IT NeedsManage Vendor RelationshipsEvaluate/Specify Brands or VendorsOther RoleAuthorize PurchasesNot Involved

Work Phone:

Company:

Company Size:

Industry:

Street Address

City:

Zip/postal code

State/Province:

Country:

Occasionally, we send subscribers special offers from select partners. Would you like to receive these special partner offers via e-mail?YesNo

Your registration with Eweek will include the following free email newsletter(s):News & Views

By submitting your wireless number, you agree that eWEEK, its related properties, and vendor partners providing content you view may contact you using contact center technology. Your consent is not required to view content or use site features.

By clicking on the "Register" button below, I agree that I have carefully read the Terms of Service and the Privacy Policy and I agree to be legally bound by all such terms.

Sendmail Package Carrying Trojan Horse

It is unknown how many servers have been exposed to the malicious code.

Someone has inserted a Trojan horse into a recent version of the source code for the widely deployed Sendmail package, exposing an unknown number of servers to remote compromise.

The files Sendmail.8.12.6.tar.gz and Sendmail.8.12.6.z, available from the open source Sendmail Consortium, are both compromised, according to an advisory released late Tuesday by the CERT Coordination Center. Currently, CERT officials say that it appears only files downloaded via the ftp.sendmail.org server contain the malicious code.

The Trojaned version of the Sendmail package began showing up on Sept. 28 and security officials are unsure how many users downloaded the corrupted files before the FTP server hosting them was disabled on Sunday.

The Trojan executes during the process of building software after it is downloaded. Once executed, the code spawns a process that connects to a remote server via TCP port 6667. The process allows a remote attacker to open a shell on the compromised server. The shell runs in the context of the user who built the Sendmail software on the local system.

Further reading

For users who have downloaded the malicious version of Sendmail, only the server on which the code was compiled—not the servers running the finished Sendmail daemon—would be compromised.

Written in 1981 by a student at the University of California at Berkeley, Sendmail is by far the most popular mail transfer agent on the Internet, running on upwards of 75 percent of mail servers, by some estimates. It is available as freeware from the Sendmail Consortium. Eric Allman, Sendmails author, is still involved in the development effort and is also the CTO at Sendmail Inc., which sells add-on products and solutions for the server.

There are two ways to determine whether youve downloaded a compromised copy: verifying the PGP signature or the MD5 checksum of the file. The Trojaned version did not have an updated PGP signature.

The PGP signature and checksum are included in the CERT advisory, available here .

The Sendmail Consortiums FTP server is still unavailable as of Wednesday morning, but clean source code can be downloaded via HTTP.